What is CVE-2026-13752?

CVE-2026-13752 is a medium-severity vulnerability in Snowflake Cli, classified under SQL Injection. CVSS score: 6.0/10. Published 2026-06-29.

How severe is CVE-2026-13752?

Medium severity. CVSS v3 base score is 6.0 out of 10.

SQL Injection in Snowflake Cli

CVE-2026-13752

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in the context of the user’s Snowflake session. Successful exploitation required crafted values to reach vulnerable parameters, including through socially engineered input, malicious repository configuration, or compromised automation feeding external values into the CLI, and impact is limited by the privileges assigned to the active session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

Vulnerability class: SQL Injection

EPSS: 0.002 (8.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N.

Affected products

Snowflake Cli — versions 1.1.0
Snowflake Snowflake_cli

Weakness classification (CWE)

CWE-89 — SQL Injection

References

412d305a-227d-44f9-a262-a31ba44f2aea (Vendor Advisory)

Frequently asked questions

What is CVE-2026-13752?: CVE-2026-13752 is a medium-severity vulnerability in Snowflake Cli, classified under SQL Injection. CVSS score: 6.0/10. Published 2026-06-29.
How severe is CVE-2026-13752?: Medium severity. CVSS v3 base score is 6.0 out of 10.